For management and maintenance of an information processing system, a person who is in charge of the management and maintenance (to be referred to as “administrator” below) needs to identify, when a fault occurs in the information processing system, a cause of the fault. A log output by the information processing system may become an important clue when the administrator identifies the cause of the fault. However, since a log output by the information processing system is huge, it is difficult for the administrator to analyze the entire log in detail.
For the above reason, to identify the cause of the fault, the administrator needs to identify a message indicating a direct or indirect cause of occurrence of the fault (referred to as “cause message” below) from the huge amount of log output by the information processing system. Then, the administrator analyzes, in detail, the identified cause message and the log around the cause message, and thereby identifies the cause of the fault.
PTL 1 discloses an example of a technology of detecting, from a log of a huge size output by an information processing system, a pattern of messages appearing at a frequency different from that in normal operation. The technology disclosed in PTL 1 extracts, from a log output by the information processing system in normal operation (referred to as “normal log” below), a typical pattern, such as a frequency at which messages appear in a normal log (referred to as “normal pattern” below). The technology disclosed in PTL 1 compares the normal pattern with a log output by the information processing system as an analysis target (referred to as “analysis-target log” below) and extracts the difference therebetween. As a result, the technology disclosed in PTL 1 is able to detect, from the analysis-target log, a message appearing at a frequency different from that in normal operation.